Security

What are some potential correlation search SPL?

AL3Z
Builder

Hi,

Looking for SPL like within a brief span of time, say two hours, a user prompts alerts for both PDM and encrypted files.

thanks

Labels (4)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @AL3Z,

probably you should try to better describe your requirement!

whick data source are you speaking?

why do you speak of Correlation Search?

did you checked if in Splunk baseline there's some Use Case for your technology?

did you checked if in Splunk Security essentials App there's some Use Case for your technology?

Ciao.

Giuseppe

0 Karma

AL3Z
Builder

@gcusello 
Hi,

My requirement to find the where a user triggers both PDM and Encrypted file alerts in a short period of time (like 2 hours)
Datasource is of DLP

Ciao.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @AL3Z,

could you share some sample of these two kind of alerts?

indicating the correlation key between them?

Ciao.

Giuseppe

0 Karma

AL3Z
Builder

..

0 Karma

AL3Z
Builder

Pls use above sample event for this use case
when  User triggers diferent PDM alerts in a short period of time (EX Block on Gmail and block on external apps)...

0 Karma

gcusello
SplunkTrust
SplunkTrust

hi @AL3Z,

this is one alert sample and the other?

could you highlight in bold the correlation key to use?

Ciao.

Giuseppe

0 Karma

AL3Z
Builder

@gcusello 

Please find the sample event key points highlighted with red colour 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @AL3Z,

this is one kind of alert (PDM I suppose), can you share a sample of the other kind of alert or does it have the same format and only different message?

Ciao.

Giuseppe 

0 Karma

AL3Z
Builder

@gcusello could you brief about  PDM abbrevation and concept

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @AL3Z,

PDM is an acronym that I don't know and that you used.

In few words, you have to:

  • identify the rules to filter only the events you need in both data sources (e.g. index and sourcetype), for this reason I asked two samples of data, one for each data source to correlate,
  • then identify a correlation key (e.g. user), a common field in both the data sources, if they have a different file name you have to rename one of them to have the same,
  • and then define the rules (e.g. user present in both the data sources) to apply a final filter,

in this way , you should have something like this, to find events where user is present in both data sources:

(index=index1 sourcetype=sourcetype1) OR (index=index2 sourcetype=sourcetype2)
| stats dc(index) AS index_count values(index) AS index BY user
| where index_count=2

 Ciao.

Giuseppe

0 Karma

AL3Z
Builder

@gcusello ,

Hi,

You're on different track my requirement is if single user triggers an alert say alert_name other than pdm in between 2 hours more than 3 times .

How could we achieve it using eval .

Thanks 👍

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @AL3Z,

so the condition is triggering an alert, not that the alert must be in both the indexes,

in this case, please try the same with a different final condition:

(index=index1 sourcetype=sourcetype1) OR (index=index2 sourcetype=sourcetype2)
| stats dc(index) AS index_count values(index) AS index values(pdm) AS pdm BY user
| where index_count=1 AND index=index1 

the thing that I don't understand is what's the condition for pdm.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...